CVS commit: [pkgsrc-2026Q2] pkgsrc/security/p5-Crypt-OpenSSL-X509

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: [pkgsrc-2026Q2] pkgsrc/security/p5-Crypt-OpenSSL-X509
From: "Maya Rashish" <maya%netbsd.org@localhost>
Date: Thu, 16 Jul 2026 21:11:56 +0000

Module Name:    pkgsrc
Committed By:   maya
Date:           Thu Jul 16 21:11:56 UTC 2026

Modified Files:
        pkgsrc/security/p5-Crypt-OpenSSL-X509 [pkgsrc-2026Q2]: Makefile
            distinfo

Log Message:
Pullup ticket #7184 - requested by taca
security/p5-Crypt-OpenSSL-X509: Security fix

Revisions pulled up:
- security/p5-Crypt-OpenSSL-X509/Makefile                       1.3
- security/p5-Crypt-OpenSSL-X509/distinfo                       1.2

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Tue Jul 14 09:17:17 UTC 2026

   Modified Files:
        pkgsrc/security/p5-Crypt-OpenSSL-X509: Makefile distinfo

   Log Message:
   p5-Crypt-OpenSSL-X509: update to 2.1.3.

   ## 2.1.3 2026-07-12

   - Fixed CVE-2026-58102: heap out-of-bounds read in `hv_exts()`.
   The function allocated a fixed 128-byte buffer for an extension's
   OID string but used `OBJ_obj2txt()`'s return value (the full required
   length, not the number of bytes actually written) as the key length
   passed to `hv_store()`. A certificate with an extension whose OID
   stringifies to more than 128 bytes caused a heap over-read. Fixed
   with a two-phase `OBJ_obj2txt()` call (probe the required length,
   allocate exactly, then format) and by using `strlen(key)` rather
   than the `OBJ_obj2txt()` return value for the `hv_store()` key
   length. This is a **security fix; update is strongly recommended**

   - Fixed CVE-2026-58101: NULL-pointer dereference in several
   `Crypt::OpenSSL::X509::Extension` helpers. `X509V3_EXT_d2i()`
   returns `NULL` when an extension's DER payload fails to parse, and
   the `AUTHORITY_KEYID` `keyid` field is legitimately `NULL` for
   Authority Key Identifiers that carry only issuer/serial. `basicC()`,
   `ia5string()`, `auth_att()`, and `keyid_data()` dereferenced these
   values unconditionally, allowing an attacker-supplied certificate
   to crash any process that parsed it. All four helpers now guard
   against `NULL`; `basicC()` croaks on unparseable DER (since it
   feeds a CA/pathLen security decision), the others fall back to safe
   empty values. This is a **security fix; update is strongly
   recommended**

   - Hardened `bit_string()` and `extendedKeyUsage()` with the same
   defence-in-depth `NULL` guards as the CVE-2026-58101 fix, for
   consistency across all extension helpers, even though the underlying
   OpenSSL calls were already `NULL`-tolerant

   - Fixed several memory leaks and undefined-behaviour issues found
   during review of the above fixes: `auth_att()` no longer leaks the
   `AUTHORITY_KEYID` on every call; `extendedKeyUsage()` no longer
   leaks the popped `ASN1_OBJECT`s or the `STACK_OF(ASN1_OBJECT)`
   container, and now guards `OBJ_nid2sn()`'s result (which can be
   `NULL` for unregistered NIDs) before passing it to `BIO_printf()`'s
   `%s` format; `bit_string()` no longer leaks the `ASN1_BIT_STRING`
   returned by `X509V3_EXT_d2i()`; `hv_exts()` now rejects empty OIDs
   and checks the return value of its second `OBJ_obj2txt()` call
   rather than assuming success

   - Documented `basicC()`, `ia5string()`, `bit_string()`, `auth_att()`,
   `keyid_data()`, and `extendedKeyUsage()` in the
   `Crypt::OpenSSL::X509::Extension` POD, explicitly noting that
   `basicC()` throws on malformed DER so callers should wrap it in
   `eval {}`

   ## 2.1.2 2026-06-25

   - Applied PR
   [#128](https://github.com/dsully/perl-crypt-openssl-x509/pull/128)
   from @maxbes (Maxime Besson) fixing `has_extension_oid` returning
   incorrect results when multiple certificates are instantiated in
   a single Perl process. The previous implementation stored the
   extension cache in a package variable, causing it to be shared
   across all certificate objects. The cache is now held per-instance,
   so each certificate object maintains its own independent extension
   list. This is a **bug fix release; update is recommended**.
   Contributed by @maxbes

   ## 2.1.1 2026-06-03

   - Applied PR
   [#126](https://github.com/dsully/perl-crypt-openssl-x509/pull/126)
   moving `-DOPENSSL_API_COMPAT` from `OPTIMIZE` to `CCFLAGS`.
   Previously, users could override `OPTIMIZE` (e.g., `perl Makefile.PL
   OPTIMIZE='-Wdiscarded-qualifiers'`), which silently dropped the
   `-DOPENSSL_API_COMPAT` define and caused OpenSSL 3.0 deprecation
   warnings. Now placed in `CCFLAGS` (appended to existing ccflags)
   to ensure it is always applied regardless of user `OPTIMIZE`
   settings. Closes issue
   [#123](https://github.com/dsully/perl-crypt-openssl-x509/issues/123).
   Contributed by @jonasbn with co-authoring from Claude

   - Applied PR
   [#125](https://github.com/dsully/perl-crypt-openssl-x509/pull/125)
   fixing const-correctness warnings reported by @ppisar in follow-up
   feedback on issue
   [#123](https://github.com/dsully/perl-crypt-openssl-x509/issues/123).
   OpenSSL 1.1.0+ returns const-qualified pointers from several accessor
   functions; added explicit casts at read-only call sites to resolve
   `-Wdiscarded-qualifiers` and
   `-Wincompatible-pointer-types-discards-qualifiers` warnings. Affected
   functions: `X509_get_ext()`, `X509_get_subject_name()`,
   `X509_get_issuer_name()`, `X509_get_X509_PUBKEY()`,
   `X509_EXTENSION_get_object()`, `X509_CRL_get_issuer()`,
   `X509_NAME_get_entry()`. Contributed by @jonasbn with co-authoring
   from Claude

   - Improved OpenSSL version detection in tests when `OPENSSL_PREFIX`
   is set. Test suite now reports the version of the OpenSSL library
   actually being tested (as specified by `scripts/test.sh`) rather
   than the default PATH binary. Also added warning when `OPENSSL_PREFIX`
   points to a missing or non-executable binary to avoid silent
   failures. Contributed by @jonasbn with co-authoring from Claude

   - Applied PR
   [#124](https://github.com/dsully/perl-crypt-openssl-x509/pull/124)
   adding OpenSSL 4.0 compatibility, addressing issue
   [#123](https://github.com/dsully/perl-crypt-openssl-x509/issues/123).
   OpenSSL 4.0.0 made `ASN1_STRING` types opaque, breaking direct
   struct member access. Conditional compilation (`OPENSSL_VERSION_NUMBER
   >= 0x40000000L`) now uses accessor functions (`ASN1_STRING_length()`,
   `ASN1_STRING_get0_data()`, `ASN1_STRING_type()`) for OpenSSL 4.x
   while maintaining backward compatibility with earlier versions.
   Fixed functions: `sig_print()`, `ia5string()`, `keyid_data()`,
   `is_asn1_type()`, `encoding()`. Also fixed a buffer over-read and
   memory leaks in `ia5string()` and `keyid_data()`. Added
   `OPENSSL4_TESTING.md` with build and test instructions and
   `scripts/test.sh` for testing against multiple OpenSSL versions.
   Contributed by @jonasbn with co-authoring from Copilot and Claude

   - Applied PR
   [#122](https://github.com/dsully/perl-crypt-openssl-x509/pull/122)
   improving documentation for the `subjectaltname` method, addressing
   issue [#92](https://github.com/dsully/perl-crypt-openssl-x509/issues/92).
   All eight `GeneralName` types defined in the embedded ASN.1 schema
   are now listed with type annotations; notes that `otherName` (tag
   `[0]` per RFC 5280) is not implemented. Contributed by @jonasbn


To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.2.2.1 pkgsrc/security/p5-Crypt-OpenSSL-X509/Makefile
cvs rdiff -u -r1.1 -r1.1.2.1 pkgsrc/security/p5-Crypt-OpenSSL-X509/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/p5-Crypt-OpenSSL-X509/Makefile
diff -u pkgsrc/security/p5-Crypt-OpenSSL-X509/Makefile:1.2 pkgsrc/security/p5-Crypt-OpenSSL-X509/Makefile:1.2.2.1
--- pkgsrc/security/p5-Crypt-OpenSSL-X509/Makefile:1.2  Sun Jun  7 13:35:24 2026
+++ pkgsrc/security/p5-Crypt-OpenSSL-X509/Makefile      Thu Jul 16 21:11:56 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.2 2026/06/07 13:35:24 wiz Exp $
+# $NetBSD: Makefile,v 1.2.2.1 2026/07/16 21:11:56 maya Exp $
 
-DISTNAME=              Crypt-OpenSSL-X509-2.0.1
+DISTNAME=              Crypt-OpenSSL-X509-2.1.3
 PKGNAME=               p5-${DISTNAME}
-PKGREVISION=           1
 CATEGORIES=            security perl5
-MASTER_SITES=          ${MASTER_SITE_PERL_CPAN:=Crypt/}
+MASTER_SITES=          ${MASTER_SITE_PERL_CPAN:=../../authors/id/J/JO/JONASBN/}
 
 MAINTAINER=            pkgsrc-users%NetBSD.org@localhost
 HOMEPAGE=              https://github.com/dsully/perl-crypt-openssl-x509

Index: pkgsrc/security/p5-Crypt-OpenSSL-X509/distinfo
diff -u pkgsrc/security/p5-Crypt-OpenSSL-X509/distinfo:1.1 pkgsrc/security/p5-Crypt-OpenSSL-X509/distinfo:1.1.2.1
--- pkgsrc/security/p5-Crypt-OpenSSL-X509/distinfo:1.1  Tue Jun  2 13:23:06 2026
+++ pkgsrc/security/p5-Crypt-OpenSSL-X509/distinfo      Thu Jul 16 21:11:56 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.1 2026/06/02 13:23:06 taca Exp $
+$NetBSD: distinfo,v 1.1.2.1 2026/07/16 21:11:56 maya Exp $
 
-BLAKE2s (Crypt-OpenSSL-X509-2.0.1.tar.gz) = d80ac3fe982d08ab4cae487b3fc902be88a031745c62096d319c98492aea1f94
-SHA512 (Crypt-OpenSSL-X509-2.0.1.tar.gz) = 987a033c3de1ab7ed4a3da012979bb98a8ed1f0766397f564d6996276cc254a3b79982df2f6f956da6cdfd3ad370e23d1e0656afe35ab261c2fc3e0f16b0b64b
-Size (Crypt-OpenSSL-X509-2.0.1.tar.gz) = 155190 bytes
+BLAKE2s (Crypt-OpenSSL-X509-2.1.3.tar.gz) = f4520a9f15609840939fd4e15d52b88c2046affad119385bf99f9ce0a89e2931
+SHA512 (Crypt-OpenSSL-X509-2.1.3.tar.gz) = 3ae95f75e47b44253c3b978863b35a36085c44f4740c5974d955430b8ef0ac4bb6fcde7d97d03aa0a546b14eeecc669c82d2f0463ba3719b4336df8d4ee254a1
+Size (Crypt-OpenSSL-X509-2.1.3.tar.gz) = 178318 bytes

Prev by Date: CVS commit: [pkgsrc-2026Q2] pkgsrc/lang/perl5
Next by Date: CVS commit: [pkgsrc-2026Q2] pkgsrc/www/p5-Mojolicious
Previous by Thread: CVS commit: [pkgsrc-2026Q2] pkgsrc/lang/perl5
Next by Thread: CVS commit: [pkgsrc-2026Q2] pkgsrc/www/p5-Mojolicious
Indexes:

Home | Main Index | Thread Index | Old Index